HTTP Headers for Filtering Rules <scanHeaders>


The <scanHeaders> element of the <filteringRule> element defines a collection of HTTP headers that a request filtering rule will scan for strings that are specified in the <denyStrings> collection. The <scanHeaders> element contains a series of <add> elements, each of which specifies a unique HTTP header to add to the collection.


Version Notes
IIS 7.5 The <filteringRules> element of the <requestFiltering> element ships as a feature of IIS 7.5.
IIS 7.0 The <filteringRules> element of the <requestFiltering> element was introduced as an update for IIS 7.0 that is available through Microsoft Knowledge Base Article 957508.
IIS 6.0 The <filteringRules> element is roughly analogous to the RuleList feature that was added to URLScan 3.0.


The default installation of IIS 7 includes the Request Filtering role service. If the Request Filtering role service is uninstalled, you can reinstall it using the following steps.

Windows Server 2008 or Windows Server 2008 R2

  1. On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
  2. In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
  3. In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
  4. On the Select Role Services page of the Add Role Services Wizard, select Request Filtering, and then click Next.
  5. On the Confirm Installation Selections page, click Install.
  6. On the Results page, click Close.

Windows Vista or Windows 7

  1. On the taskbar, click Start, and then click Control Panel.
  2. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
  3. Expand Internet Information Services, then World Wide Web Services, and then Security.
  4. Select Request Filtering, and then click OK.

How To

How to add a request filtering rule

  1. Open Internet Information Services (IIS) Manager:
    • If you are using Windows Server 2008 or Windows Server 2008 R2:
      • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
    • If you are using Windows Vista or Windows 7:
      • On the taskbar, click Start, and then click Control Panel.
      • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  2. In the Connections pane, go to the site, application, or directory for which you want to configure request filtering.
  3. In the Home pane, double-click Request Filtering.
  4. In the Request Filtering pane, click the Rules tab.
  5. In the Actions pane, click Add Filtering Rule.
  6. Enter the following information for the filtering rule in the Add Filtering Rule dialog:
    • Enter a friendly name for the filtering rule in the Name field.
    • Select Scan url if you want the filtering rule to scan the URL stub for the request.
    • Select Scan query string if you want the filtering rule to scan the query string for the request.
    • Enter any HTTP headers to scan in the Scan Headers collection.
    • Enter the file name extensions to use with the filtering rule in the Applies To collection.
    • Enter the collection of strings to deny for the filtering rule in the Deny Strings collection.
  7. Click OK to close the Add Filtering Rule dialog.


The <scanHeaders> element of the <filteringRule> element is configured at the site, application, or directory level.



Child Elements

Element Description
add Optional element.

Adds a unique HTTP header to the collection of HTTP headers which a request filtering rule will scan.
clear Optional element.

Clears the collection of HTTP headers which a request filtering rule will scan.
remove Optional element.

Removes a unique HTTP header from the collection of HTTP headers which a request filtering rule will scan.

Configuration Sample

The following sample displays a <requestFiltering> element that uses the <denyStrings>, <appliesTo>, and <scanHeaders> elements to define a request filtering rule that will prevent image stealing (leeching) for a specific user agent.

      <filteringRule name="Block Image Leeching" scanUrl="false" scanQueryString="false" scanAllRaw="false">
            <add requestHeader="User-agent" />
            <add fileExtension=".gif" />
            <add fileExtension=".jpg" />
            <add fileExtension=".png" />
            <add string="leech-bot" />

Sample Code

The following examples demonstrate how to use the <denyStrings>, <appliesTo>, and <scanHeaders> elements to add a request filtering rule for the Default Web Site that will prevent image stealing (leeching) for a specific user agent. Here is the scenario for this example: If you detected that images on your web site were being leeched by a particular user agent, you could create a request filtering rule that denies access to image files for that specific user agent. In this particular example, the request filtering rule will search the HTTP user-agent header for the string "leech-bot," and will deny access to GIF, JPG, and PNG files if the user-agent header contains the search string.


appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching',scanUrl='False',scanQueryString='False',scanAllRaw='False']" 

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching'].scanHeaders.[requestHeader='User-agent']" 

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching'].appliesTo.[fileExtension='.gif']" 

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching'].appliesTo.[fileExtension='.jpg']" 

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching'].appliesTo.[fileExtension='.png']" 

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"filteringRules.[name='Block Image Leeching'].denyStrings.[string='leech-bot']" 


using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
   private static void Main()
      using (ServerManager serverManager = new ServerManager())
         Configuration config = serverManager.GetWebConfiguration("Default Web Site");
         ConfigurationSection requestFilteringSection = config.GetSection("system.webServer/security/requestFiltering");
         ConfigurationElementCollection filteringRulesCollection = requestFilteringSection.GetCollection("filteringRules");

         ConfigurationElement filteringRuleElement = filteringRulesCollection.CreateElement("filteringRule");
         filteringRuleElement["name"] = @"Block Image Leeching";
         filteringRuleElement["scanUrl"] = false;
         filteringRuleElement["scanQueryString"] = false;
         filteringRuleElement["scanAllRaw"] = false;

         ConfigurationElementCollection scanHeadersCollection = filteringRuleElement.GetCollection("scanHeaders");
         ConfigurationElement addElement = scanHeadersCollection.CreateElement("add");
         addElement["requestHeader"] = @"User-agent";

         ConfigurationElementCollection appliesToCollection = filteringRuleElement.GetCollection("appliesTo");
         ConfigurationElement addElement1 = appliesToCollection.CreateElement("add");
         addElement1["fileExtension"] = @".gif";
         ConfigurationElement addElement2 = appliesToCollection.CreateElement("add");
         addElement2["fileExtension"] = @".jpg";
         ConfigurationElement addElement3 = appliesToCollection.CreateElement("add");
         addElement3["fileExtension"] = @".png";

         ConfigurationElementCollection denyStringsCollection = filteringRuleElement.GetCollection("denyStrings");
         ConfigurationElement addElement4 = denyStringsCollection.CreateElement("add");
         addElement4["string"] = @"leech-bot";



Imports System
Imports System.Text
Imports Microsoft.Web.Administration
Module Sample Sub Main() Dim serverManager As ServerManager = New ServerManager Dim config As Configuration = serverManager.GetWebConfiguration("Default Web Site") Dim requestFilteringSection As ConfigurationSection = config.GetSection("system.webServer/security/requestFiltering") Dim filteringRulesCollection As ConfigurationElementCollection = requestFilteringSection.GetCollection("filteringRules") Dim filteringRuleElement As ConfigurationElement = filteringRulesCollection.CreateElement("filteringRule") filteringRuleElement("name") = "Block Image Leeching" filteringRuleElement("scanUrl") = False filteringRuleElement("scanQueryString") = False filteringRuleElement("scanAllRaw") = False Dim scanHeadersCollection As ConfigurationElementCollection = filteringRuleElement.GetCollection("scanHeaders") Dim addElement As ConfigurationElement = scanHeadersCollection.CreateElement("add") addElement("requestHeader") = "User-agent" scanHeadersCollection.Add(addElement) Dim appliesToCollection As ConfigurationElementCollection = filteringRuleElement.GetCollection("appliesTo") Dim addElement1 As ConfigurationElement = appliesToCollection.CreateElement("add") addElement1("fileExtension") = ".gif" appliesToCollection.Add(addElement1) Dim addElement2 As ConfigurationElement = appliesToCollection.CreateElement("add") addElement2("fileExtension") = ".jpg" appliesToCollection.Add(addElement2) Dim addElement3 As ConfigurationElement = appliesToCollection.CreateElement("add") addElement3("fileExtension") = ".png" appliesToCollection.Add(addElement3) Dim denyStringsCollection As ConfigurationElementCollection = filteringRuleElement.GetCollection("denyStrings") Dim addElement4 As ConfigurationElement = denyStringsCollection.CreateElement("add") addElement4("string") = "leech-bot" denyStringsCollection.Add(addElement4) filteringRulesCollection.Add(filteringRuleElement) serverManager.CommitChanges() End Sub End Module


adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site";
var requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site");
var filteringRulesCollection = requestFilteringSection.ChildElements.Item("filteringRules").Collection;

var filteringRuleElement = filteringRulesCollection.CreateNewElement("filteringRule");
filteringRuleElement.Properties.Item("name").Value = "Block Image Leeching";
filteringRuleElement.Properties.Item("scanUrl").Value = false;
filteringRuleElement.Properties.Item("scanQueryString").Value = false;
filteringRuleElement.Properties.Item("scanAllRaw").Value = false;

var scanHeadersCollection = filteringRuleElement.ChildElements.Item("scanHeaders").Collection;
var addElement = scanHeadersCollection.CreateNewElement("add");
addElement.Properties.Item("requestHeader").Value = "User-agent";

var appliesToCollection = filteringRuleElement.ChildElements.Item("appliesTo").Collection;
var addElement1 = appliesToCollection.CreateNewElement("add");
addElement1.Properties.Item("fileExtension").Value = ".gif";
var addElement2 = appliesToCollection.CreateNewElement("add");
addElement2.Properties.Item("fileExtension").Value = ".jpg";
var addElement3 = appliesToCollection.CreateNewElement("add");
addElement3.Properties.Item("fileExtension").Value = ".png";

var denyStringsCollection = filteringRuleElement.ChildElements.Item("denyStrings").Collection;
var addElement4 = denyStringsCollection.CreateNewElement("add");
addElement4.Properties.Item("string").Value = "leech-bot";



Set adminManager = createObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site"
Set requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site")
Set filteringRulesCollection = requestFilteringSection.ChildElements.Item("filteringRules").Collection

Set filteringRuleElement = filteringRulesCollection.CreateNewElement("filteringRule")
filteringRuleElement.Properties.Item("name").Value = "Block Image Leeching"
filteringRuleElement.Properties.Item("scanUrl").Value = False
filteringRuleElement.Properties.Item("scanQueryString").Value = False
filteringRuleElement.Properties.Item("scanAllRaw").Value = False

Set scanHeadersCollection = filteringRuleElement.ChildElements.Item("scanHeaders").Collection
Set addElement = scanHeadersCollection.CreateNewElement("add")
addElement.Properties.Item("requestHeader").Value = "User-agent"

Set appliesToCollection = filteringRuleElement.ChildElements.Item("appliesTo").Collection
Set addElement1 = appliesToCollection.CreateNewElement("add")
addElement1.Properties.Item("fileExtension").Value = ".gif"
Set addElement2 = appliesToCollection.CreateNewElement("add")
addElement2.Properties.Item("fileExtension").Value = ".jpg"
Set addElement3 = appliesToCollection.CreateNewElement("add")
addElement3.Properties.Item("fileExtension").Value = ".png"

Set denyStringsCollection = filteringRuleElement.ChildElements.Item("denyStrings").Collection
Set addElement4 = denyStringsCollection.CreateNewElement("add")
addElement4.Properties.Item("string").Value = "leech-bot"

Deprecated Elements